因“vibe coding”的API密钥泄露损失了300美元——从我的错误中吸取教训。
我刚刚学到了一个代价高昂的教训，想在这里分享，以免其他人犯同样的错误。
我最近因为一个API密钥泄露而损失了300美元。这一切始于谷歌云的一笔意外200美元的收费，当我调查时，发现前一天还有另一笔100美元的收费。这两笔费用都是因为我从未故意设置的Gemini API使用。
经过深入调查，我发现问题所在：我在一个我最终弃用的功能的脚本中硬编码了一个API密钥。这个文件在代码库中只存在了两天，但这足以导致密钥泄露。谷歌实际上向我发送了关于异常活动的警报，但我错过了这些警报，因为它们发送到了一个不常查看的邮箱。
我学到了以下几点：
1. 切勿硬编码API密钥 - 使用环境变量或.env文件，即使是临时代码也要如此。
2. 设置账单警报 - 谷歌云（以及其他服务提供商）允许你设置意外收费的警报。
3. 检查所有关联的邮箱 - 不要忽视通知，即使它们发送到次要账户。
4. 不要仅仅依赖GitHub的秘密扫描 - 这很有用，但重命名变量可以绕过它。
这一切发生在我尝试“氛围编码”（让AI快速生成代码）的时候，但我意识到人类的监督仍然至关重要，尤其是在安全方面。
希望这能帮助某人避免同样代价高昂的错误！
简而言之：在一个已弃用的脚本中硬编码了API密钥，密钥泄露，我被收费300美元。务必使用环境变量并设置账单警报！
查看原文
I just learned an expensive lesson and wanted to share it here so others don’t make the same mistake.<p>I recently lost $300 because of an API key leak. It started with a surprise $200 charge from Google Cloud, and when I looked into it, I found another $100 charge from the day before. Both were for Gemini API usage that I never intentionally set up.<p>After digging, I discovered the issue: I had hard-coded an API key in a script that was part of a feature I ended up deprecating. The file was only in the codebase for two days, but that was enough for the key to leak. Google actually sent me alerts about unusual activity, but I missed them because they went to a less-frequently-checked email account.<p>Here’s what I learned:<p>Never hardcode API keys - Use environment variables or a .env file, even for temporary code.<p>Set up billing alerts - Google Cloud (and other providers) let you set up alerts for unexpected charges.<p>Check all linked emails - Don’t ignore notifications, even if they’re sent to secondary accounts.<p>Don’t rely solely on GitHub’s secret scanning - It’s useful, but renaming variables can bypass it.<p>This happened while I was experimenting with "vibe coding" (letting AI generate code quickly), but I realized too late that human oversight is still crucial, especially for security.<p>Hope this helps someone avoid the same costly mistake!<p>TL;DR: Hard-coded an API key in a deprecated script, key leaked, and I got charged $300. Always use environment variables and set up billing alerts!